Posted
by
Soulskill
on Wednesday February 20, 2013 @03:00PM
from the web-of-trust dept.

msm1267 writes "The missing link connecting the attacks against Apple, Facebook and possibly Twitter is a popular iOS mobile developers' forum called iphonedevsdk which was discovered hosting malware in an apparent watering hole attack that has likely snared victims at hundreds of organizations beyond the big three. It's not clear whether the site remains infected, but researcher Eric Romang dug into the situation and determined that the site was hosting malicious JavaScript that was redirecting visitors to another site, min.liveanalytics. That site had been hosting malware as of Jan. 15."

Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run. What do you suggest that Apple should do to tidy up the security in OS X? Make it run only Apple approved binaries?

They stopped supporting future versions of Java - namely, Java 7. They still support Java 6.

In theory, by now, Java 6 support should have been dropped and Java 6 should no longer be updated at all. However, due to problems with Java 7, and compatibility issues between Apple Java and Oracle Java on Mac OS X, Java 6 lives on and is still being updated.

The Apple update to Java 6 was delivered through Software Update by Apple as an OS update. Java 6 is still done by Apple. At some point, Apple will drop support for Java entirely and the only way to run Java on Mac OS X will be to install it from Oracle.

In fact, this should have happened already. But it hasn't, yet. The next version of Mac OS X will presumably drop support for Apple's Java entirely, but as of today, it still lives on, and patches for it still come from Apple.

Of course this does not apply to Windows where hacks via flash, java, quicktime, etc are definitely the fault of the Windows OS, probably Bill Gates in particular, as he's the devil. That's always been the consensus on slashdot.

Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run.

Well that counts out just about every Windows exploit from being Microsoft's fault then, after all Windows was just dutifully letting the program run. Do you know nothing about security? If you can exploit a user level application to compromise the system then it is the system's fault.

Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run.

Well that counts out just about every Windows exploit from being Microsoft's fault then, after all Windows was just dutifully letting the program run. Do you know nothing about security? If you can exploit a user level application to compromise the system then it is the system's fault.

Not quite - it all depends where the vulnerable code is. If it's in java.dll, the fault is Oracle's. If it's in, say, user32.dll, then the fault can definitely be blamed on Microsoft.

The fix to patch the vulnerability and remove the malware if it's there is available today.

The keyword there is "today." The actual Java patch was available earlier, it's just Apple only bothered patching their version of Java until - well, after they got bitten by the vulnerability, apparently. Apple had been content to just say "applets are no longer supported" and leave it at that.

This update uninstalls the Apple-provided Java applet plug-in from all web browsers. To use applets on a webpage, click on the region labeled "Missing plug-in" to go download the latest version of the Java applet plug-in from Oracle.

You do realize that Apple has handed over Java support on OSX back to Oracle, right?

You do realize that Apple has handed over Java support on OSX back to Oracle, right?

For Java 7, yes, Apple doesn't support that. For Java 6, they still do. The Apple version of Java still exists, was vulnerable to the Java 0-day, and missed the patches that fixed it that were first released a couple of weeks ago. Their fix was instead to just disable applets entirely, which is great unless your IT department requires an applet to use their wi-fi network. (Seriously.)

And, yes, there are still some Mac OS X apps that require Apple's version of Java, because it's not completely compatible wit

You do realize that Apple has handed over Java support on OSX back to Oracle, right?

For Java 7, yes, Apple doesn't support that. For Java 6, they still do. The Apple version of Java still exists, was vulnerable to the Java 0-day, and missed the patches that fixed it that were first released a couple of weeks ago.

The fix to patch the vulnerability and remove the malware if it's there is available today.

The keyword there is "today." The actual Java patch was available earlier, it's just Apple only bothered patching their version of Java until - well, after they got bitten by the vulnerability, apparently. Apple had been content to just say "applets are no longer supported" and leave it at that.

RTFA. Seriously. There was a patch - but it didn't fully fix the hole. Not to mention that "Apple's version of Java" wasn't affected, only Java 7.

A lot of comments above are already full of hate:/ And I don't get why they blame Apple for this when clearly Oracle is at fault for letting Java stagnate this much.

When Cisco took over Linksys we ended up with lackluster hardware. No big deal. But when Oracle let their bought product stagnate, the damage is a lot more severe if only due to its sheer ubiquity and dependence.

I don't get why they blame Apple for this when clearly Oracle is at fault for letting Java stagnate this much.

The reason is because this flaw exists in Apple's implementation of Java 6 - which is still required by many people as not all apps work on Oracle's Java 7 (which was patched for this vulnerability some time ago).

I don't get why they blame Apple for this when clearly Oracle is at fault for letting Java stagnate this much.

The reason is because this flaw exists in Apple's implementation of Java 6 - which is still required by many people as not all apps work on Oracle's Java 7 (which was patched for this vulnerability some time ago).

The article just mentions that there was an exploit added to the Cool Exploit Kit that exploits that specific vulnerability, it doesn't make any suggestion that was the one used or that the Cool Exploit Kit was used, it could have been any of the many 0-day exploits patched very recently.

The site in question has been hosting malware on and off for over a year now. They were flagged at least half a dozen times by google over the past year for hosting malware. The site then went down for weeks while overhauling the entire forum software and then bam, this happens. Unfortunately some very good discussions happen on the site and I just can't quit using it.

Really? Were developing with a rule against using a search engine? They turn up in plenty of my search results for various iOS dev related things.

They were one of 'the first' iOS dev sites, earlier enough that I'd venture to say they were probably there before apple's iOS SDK existed but my memory may be a bit off, that was 5 years ago.Not knowing about this site indicates you live in a virtual box.

It's where you target a page used by multiple targets. Here a mobile developers forum was hit, that forum was not the real target but the people who use it frquently were. "Poisoning the watering hole" if you will.

It's where troopers metaphorically attack a swagman by a billabong (the 'watering hole') causing him to leap to his death and subsequently haunt the area. I won't go into detail on how this applies in relation to computer security, but I'm sure you get the gist of it.

Traditionally, you had "spear phishing" attacks which had attackers sending malware or phishing emails directly to their targets. This is relatively easy to spot and filter. The "watering hole" attacks work by compromising a trusted third-party site used by the targets. For example, if your attacker know you read Slashdot or use some specialised forum site, they could attempt to compromise those sites and use them to host exploits as part of the normal pages (infected banner ads or modified page content).

This is a good reminder that with web-security you're only as secure as the weakest link. A new exploit pushed from a popular dev site on a trusted platform like Java is going to hit you hard and you can't avoid it directly. The real story here is how quickly / properly people responded, and how well defensive infastructure and policy stopped the intrusion. There's months and months of good security analytical reading right here. We can also compare company to company as it hit more than one.

Sorry, what? Several things come to mind when I think about Java, "trusted" is not one of those things. Java is a textbook example of a single piece of the platform (the browser plugins) giving the entire thing a bad name, even if it's not justified. Anyone who still browses around the general internet with a browser that has the Java plugins enabled is either unaware of what the Java plugin is, or stupid. If you're a Java developer, have one browser with your plugins enabled that you use only to develo

Yes, running a no-script browser is techincally safer, but it's also technically useless as you're missing out on the content provided by those scripted services. Do you manually type in captcha hashes? Do you ignore all video posted anywhere? You'll never run a single script, ever? A browser is inherently insecure as it's entire purpose is to download and render remote scripts.

Yes, running a no-script browser is techincally safer, but it's also technically useless as you're missing out on the content provided by those scripted services. Do you manually type in captcha hashes? Do you ignore all video posted anywhere? You'll never run a single script, ever?

Where did you get that from? The interface of the major application I work on is over 1.5MB of Javascript. I don't disable Javascript. I disable plugins from automatically starting plugin content. This has nothing to do with scripting. I'm talking about Java, not Javascript. Hopefully you know the difference, if you don't then don't bother to reply to things like this. As for video specifically, if I come across a Flash video on a news site or whatever that they embedded in a way where click-to-start

Apple devs wouldn't know security if it bit them in the iPhone so this is less than surprising. Then you use a browser exploit that targets macs, which is (debatably) easier to make and tada. I'm going to take a wild guess that Facebook's devs aren't too bright either, based solely on their coding and design work aka the Facebook website.

Ah, the weakly supported claims that China is at an all-out "cyberwar" now become clearer. The Chinese army must have created the site min.liveanalytics.org. Then they deviously drew in visitors from a popular site, including some from major US corporations. For any machine that was vulnerable, China has thusly "hacked" the corporations owning those machines. Hackers get cred, the news media gets to scream that the sky is falling, and the US government gets to increase funding for the "war on cyberterror".